Windows Lock Screen Bypassed Using Cortana Vulnerability; Already Patched

In another interesting research work presented at Black Hat USA 2018, a group of researchers from Kzen Networks and Isreal Institute of Technology’s Ron Marcovich and Yuval Ron has revealed a flaw in Cortana that allowed them to bypass the lock screen and execute arbitrary codes.

Dubbed as ‘Open Sesame,’ the flaw exploits a computer running on Windows 10 with the help of Cortana, Windows’ native voice assistant. The sneak in was possible because of Cortana’s “universal access methods” and allowed the researchers to execute risky commands without unlocking the screen.

CVE-2018-8140 has been assigned to the vulnerability. One of the major reasons why this vulnerability exists is the fact that the lock screen on Windows 10 devices bars the access of keyboard, but users can invoke Cortana through voice. Also the fact that user interface on the lock screen has app functionality even before you unlock the device.

“In the past, the OS made sure the UI is not accessible when the computer is locked, and therefore developers did not need to think about it. Now it’s the developers’ responsibility,” said Be’ery, one of the researchers.

According to the researchers, once you bypass the lock screen, you could view files, browse the internet, download executable files from the Internet and also get elevated privileges.

The researchers had already reported the vulnerability to Microsoft, and a patch had been issued on June 18 to fix the issue.

If you have not applied the patch, you can disable Cortana from your lock screen to evade the flaw.

Also Read: Black Hat 2018: Satellite Communication Systems Hackable; Threat For Aviation Industry